4 ms·

That's not so easy nowadays. Firstly with covid-19 many banks don't accept walk-ins and have a long waiting list for appointments. Secondly, what if the bank

by Dr_ReD 4y ago

That's not so easy nowadays. Firstly with covid-19 many banks don't accept walk-ins and have a long waiting list for appointments. Secondly, what if the bank or other service i'm using has no physical offices at all? Or what if they're simply too far away and I'm an octogenarian, perhaps with no driving license? Eh? Am I supposed to take an uber to somewhere 100/200 miles away just because morons are given decision-making power and myopic online-apologists on HN even make excuses for them?

alldayeveryday 4y ago
Your argumentation is myopic. I'm not seeing anyone making excuses. I'm seeing people face the realities that few systems (if any) are without single points of failure. Take the mobile app dependency away from banking. Then what? There's a dependency on having a computer. A dependency on having power and internet. Why did the banking system build around these single points of failure? The reality of system design dictates that you measure risk in terms of what is acceptable vs not-acceptable, the solution on whether it is practical vs not-practical, and the implementation on whether it is economically viable. Raising a stink because your bank wants you to use a mobile phone for verification is like complaining that your car requires gasoline to work. Are there other ways of solve the problem? Sure. Did the solution they landed on meet their requirements, yes. I hardly consider them morons for going with the cell phone approach.
- cassianoleal 4y ago
  > Take the mobile app dependency away from banking. Then what? There's a dependency on having a computer. A computer, but not necessarily the one authorised computer. You can use a public one in a library, a friend's, your employer's, etc. Not the same as your own and only authorised smartphone. > A dependency on having power and internet. This is honestly not even an argument, and they're not a SPOF. Both the power grid and the Internet have redundancies built-in. > is like complaining that your car requires gasoline to work. Again, it's not. The smartphone is used as a single authorised device. Gasoline works regardless of which station you purchase it from. Out of petrol? Fill it up at the nearby station and carry on. Or preferably, don't let it run out in the first place. > I hardly consider them morons for going with the cell phone approach. I don't consider them morons either. That's not to say I don't recognise this as a weakness.
  - alldayeveryday 4y ago
    > Again, it's not. The smartphone is used as a single authorised device. Gasoline works regardless of which station you purchase it from. Out of petrol? Fill it up at the nearby station and carry on. Or preferably, don't let it run out in the first place. A mobile phone works regardless of which store you purchase it from. Lost your phone? Pickup a new one at a nearby store and carry on. Or preferably, don't lose it in the first place.
    - cassianoleal 4y ago
      Again, a mobile phone works regardless of where you purchase it. Your banking systems, etc are not authorised to a mobile phone, though. They're authorised to the one mobile phone that was authenticated. It's not enough to buy a new phone. You need to contact every single service that's bound to the lost/stolen/broken phone and authorise the new one before you can use their services. In the case of the car, it's enough to just fill up the tank with petrol purchased anywhere. It's ready to carry on at that point.
      - alldayeveryday 4y ago
        Not clear your meaning. Are you referring to the mobile phone being used during 2FA auth flows? In this case, the authorization is not to a device but rather to a number on the cellular network. You can swap devices without your bank knowing and without disrupting your authorization. Are you referring to mobile banking apps? If so, again, the bank is not authorizing an individual device. The authorization is a sign in session on the app. You can swap phones and download the app very easily without contacting the bank. > It's not enough to buy a new phone. You need to contact every single service that's bound to the lost/stolen/broken phone and authorize the new one before you can use their services. Are you referring to changing phone numbers maybe? If so, that is a totally different topic from OP and also from my comments.
Double_a_92 4y ago
That was the point of my "argument". I was trying to point out how silly the original comment was.

by Dr_ReD 4y ago

alldayeveryday 4y ago

Your argumentation is myopic. I'm not seeing anyone making excuses. I'm seeing people face the realities that few systems (if any) are without single points of failure. Take the mobile app dependency away from banking. Then what? There's a dependency on having a computer. A dependency on having power and internet. Why did the banking system build around these single points of failure? The reality of system design dictates that you measure risk in terms of what is acceptable vs not-acceptable, the solution on whether it is practical vs not-practical, and the implementation on whether it is economically viable. Raising a stink because your bank wants you to use a mobile phone for verification is like complaining that your car requires gasoline to work. Are there other ways of solve the problem? Sure. Did the solution they landed on meet their requirements, yes. I hardly consider them morons for going with the cell phone approach.

cassianoleal 4y ago
> Take the mobile app dependency away from banking. Then what? There's a dependency on having a computer. A computer, but not necessarily the one authorised computer. You can use a public one in a library, a friend's, your employer's, etc. Not the same as your own and only authorised smartphone. > A dependency on having power and internet. This is honestly not even an argument, and they're not a SPOF. Both the power grid and the Internet have redundancies built-in. > is like complaining that your car requires gasoline to work. Again, it's not. The smartphone is used as a single authorised device. Gasoline works regardless of which station you purchase it from. Out of petrol? Fill it up at the nearby station and carry on. Or preferably, don't let it run out in the first place. > I hardly consider them morons for going with the cell phone approach. I don't consider them morons either. That's not to say I don't recognise this as a weakness.
- alldayeveryday 4y ago
  > Again, it's not. The smartphone is used as a single authorised device. Gasoline works regardless of which station you purchase it from. Out of petrol? Fill it up at the nearby station and carry on. Or preferably, don't let it run out in the first place. A mobile phone works regardless of which store you purchase it from. Lost your phone? Pickup a new one at a nearby store and carry on. Or preferably, don't lose it in the first place.
  - cassianoleal 4y ago
    Again, a mobile phone works regardless of where you purchase it. Your banking systems, etc are not authorised to a mobile phone, though. They're authorised to the one mobile phone that was authenticated. It's not enough to buy a new phone. You need to contact every single service that's bound to the lost/stolen/broken phone and authorise the new one before you can use their services. In the case of the car, it's enough to just fill up the tank with petrol purchased anywhere. It's ready to carry on at that point.
    - alldayeveryday 4y ago
      Not clear your meaning. Are you referring to the mobile phone being used during 2FA auth flows? In this case, the authorization is not to a device but rather to a number on the cellular network. You can swap devices without your bank knowing and without disrupting your authorization. Are you referring to mobile banking apps? If so, again, the bank is not authorizing an individual device. The authorization is a sign in session on the app. You can swap phones and download the app very easily without contacting the bank. > It's not enough to buy a new phone. You need to contact every single service that's bound to the lost/stolen/broken phone and authorize the new one before you can use their services. Are you referring to changing phone numbers maybe? If so, that is a totally different topic from OP and also from my comments.

Double_a_92 4y ago

That was the point of my "argument". I was trying to point out how silly the original comment was.